@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Impact @fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fail...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-6270 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098213...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-6270 Source advisory: OSV:GHSA-72C6-FX6Q-FR5W...

GHSA-72C6-FX6Q-FR5W @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Impact @fastify/middie v9.3.1 and earlier incorrectly re-prefixes middleware paths when propagating them to child plugin scopes. When a child plugin is registered with a prefix that overlaps with a parent-scoped middleware path, the middleware path is modified during inheritance and silently fail...

EUVD-2026-23235

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option...

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict in the resolveNormalizationOptions function's deprecated ignoreDuplicateSlashes configuration option. An attacker can bypass middleware by crafting URLs with...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-33804 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098212...

@fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

Impact @fastify/middie v9.3.1 and earlier does not read the deprecated but still functional top-level ignoreDuplicateSlashes option, only reading from routerOptions. This creates a normalization gap: Fastify's router normalizes duplicate slashes but middie does not, allowing middleware bypass via...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-33804 Source advisory: OSV:GHSA-V9WW-2J6R-98Q6...

CVE-2026-33804

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

CVE-2026-6270

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...

CVE-2026-33804 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

CVE-2026-33804 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

CVE-2026-33804

CVE-2026-33804 affects @fastify/middie v9.3.1 and earlier, where middleware bypass can occur when the deprecated top-level ignoreDuplicateSlashes option is enabled. The middleware’s path-matching does not account for duplicate-slash normalization performed by Fastify’s router, allowing requests w...

CVE-2026-33804 @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash normalization performed by Fastify's router, allowing requests with duplicat...

CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...

CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...

CVE-2026-6270

Summary : The vulnerability affects the Node.js module @fastify/middie, specifically versions 9.3.1 and earlier. The root cause is that inherited middleware is not registered on child plugin engine instances, so when a Fastify app registers authentication middleware in a parent scope and then loa...

CVE-2026-6270 @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...

CVE-2026-6270

@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registers child plugins with @fastify/middie, the child scope does not inherit the...